skybridge 0.0.0-dev.edd7e4d → 0.0.0-dev.eddca63

package/dist/cli/build-helpers.d.ts

@@ -1,5 +1,6 @@
-export declare const ENTRY_WRAPPER_CONTENT = "import { __setBuildManifest } from \"skybridge/server\";\nimport manifest from \"./vite-manifest.js\";\n\n__setBuildManifest(manifest);\n\nconst userMod = await import(\"./server.js\");\nexport default userMod.default;\n";
+export declare const ENTRY_WRAPPER_CONTENT = "import { __setBuildManifest, __setSkillsManifest } from \"skybridge/server\";\nimport manifest from \"./vite-manifest.js\";\nimport skills from \"./skills.js\";\n\n__setBuildManifest(manifest);\n__setSkillsManifest(skills);\n\nconst userMod = await import(\"./server.js\");\nexport default userMod.default;\n";
 export declare function emitEntryWrapper(distDir: string): void;
+export declare function emitSkillsModule(skillsDir: string, outPath: string): void;
 export declare function emitManifestModule(manifestPath: string, outPath: string): void;
 /** Emit an empty Vite manifest for view-less (headless) servers. */
 export declare function emitEmptyManifestModule(outPath: string): void;

package/dist/cli/build-helpers.js

@@ -1,14 +1,19 @@
 import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
 import path from "node:path";
-// Primes the manifest in skybridge's module scope, then dynamically imports
-// `./server.js` so user code runs *after* the side channel is set. The
-// dynamic import is load-bearing: a static `export { default } from ...` is
-// hoisted with the rest of the static graph and would evaluate `server.js`
-// before `__setBuildManifest` runs.
-export const ENTRY_WRAPPER_CONTENT = `import { __setBuildManifest } from "skybridge/server";
+import { discoverSkills } from "../server/skills.js";
+// Primes the manifest and skills snapshot in skybridge's module scope, then
+// dynamically imports `./server.js` so user code runs *after* the side channels
+// are set. The dynamic import is load-bearing: a static
+// `export { default } from ...` is hoisted with the rest of the static graph
+// and would evaluate `server.js` before the primers run. Both `skills.js` and
+// the manifest are imported (not read from disk) so they ride the bundle on
+// filesystem-less targets like Cloudflare Workers.
+export const ENTRY_WRAPPER_CONTENT = `import { __setBuildManifest, __setSkillsManifest } from "skybridge/server";
 import manifest from "./vite-manifest.js";
+import skills from "./skills.js";
 
 __setBuildManifest(manifest);
+__setSkillsManifest(skills);
 
 const userMod = await import("./server.js");
 export default userMod.default;
@@ -16,6 +21,10 @@ export default userMod.default;
 export function emitEntryWrapper(distDir) {
     writeFileSync(path.join(distDir, "__entry.js"), ENTRY_WRAPPER_CONTENT);
 }
+export function emitSkillsModule(skillsDir, outPath) {
+    const skills = discoverSkills(skillsDir);
+    writeFileSync(outPath, `export default ${JSON.stringify(skills)};\n`);
+}
 export function emitManifestModule(manifestPath, outPath) {
     const manifest = readFileSync(manifestPath, "utf-8");
     writeFileSync(outPath, `export default ${manifest};\n`);

package/dist/cli/build-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-helpers.js","sourceRoot":"","sources":["../../src/cli/build-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,4EAA4E;AAC5E,uEAAuE;AACvE,4EAA4E;AAC5E,2EAA2E;AAC3E,oCAAoC;AACpC,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;CAOpC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAAe;IAEf,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrD,aAAa,CAAC,OAAO,EAAE,kBAAkB,QAAQ,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,aAAa,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAY;IACpC,OAAO,EAAE,CAAC;IACV,MAAM,EAAE;QACN;YACE,GAAG,EAAE,cAAc;YACnB,OAAO,EAAE,EAAE,6BAA6B,EAAE,GAAG,EAAE;YAC/C,QAAQ,EAAE,IAAI;SACf;QACD,EAAE,MAAM,EAAE,YAAY,EAAE;QACxB,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,oBAAoB,EAAE,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAY;IACvC,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,UAAU;IACnB,YAAY,EAAE,QAAQ;IACtB,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAEF,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,SAAS,EACT,WAAW,EACX,GAAG,oBAAoB,OAAO,CAC/B,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEjE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC;QACV,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC;QACvC,iEAAiE;QACjE,MAAM,EAAE,EAAE,sBAAsB,EAAE,cAAc,EAAE;QAClD,0EAA0E;QAC1E,wEAAwE;QACxE,QAAQ,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACzC,MAAM,EAAE;YACN,iEAAiE;YACjE,EAAE,EAAE,sFAAsF;SAC3F;KACF,CAAC,CAAC;IAEH,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACrC,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC;IACF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAClC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EACnC,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  cpSync,\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport path from \"node:path\";\n\n// Primes the manifest in skybridge's module scope, then dynamically imports\n// `./server.js` so user code runs *after* the side channel is set. The\n// dynamic import is load-bearing: a static `export { default } from ...` is\n// hoisted with the rest of the static graph and would evaluate `server.js`\n// before `__setBuildManifest` runs.\nexport const ENTRY_WRAPPER_CONTENT = `import { __setBuildManifest } from \"skybridge/server\";\nimport manifest from \"./vite-manifest.js\";\n\n__setBuildManifest(manifest);\n\nconst userMod = await import(\"./server.js\");\nexport default userMod.default;\n`;\n\nexport function emitEntryWrapper(distDir: string): void {\n  writeFileSync(path.join(distDir, \"__entry.js\"), ENTRY_WRAPPER_CONTENT);\n}\n\nexport function emitManifestModule(\n  manifestPath: string,\n  outPath: string,\n): void {\n  const manifest = readFileSync(manifestPath, \"utf-8\");\n  writeFileSync(outPath, `export default ${manifest};\\n`);\n}\n\n/** Emit an empty Vite manifest for view-less (headless) servers. */\nexport function emitEmptyManifestModule(outPath: string): void {\n  writeFileSync(outPath, \"export default {};\\n\");\n}\n\nexport function ensureAssetsDir(assetsDir: string): void {\n  mkdirSync(assetsDir, { recursive: true });\n}\n\nexport const VERCEL_FUNCTION_NAME = \"mcp\";\n\nexport const VERCEL_CONFIG: unknown = {\n  version: 3,\n  routes: [\n    {\n      src: \"/assets/(.*)\",\n      headers: { \"Access-Control-Allow-Origin\": \"*\" },\n      continue: true,\n    },\n    { handle: \"filesystem\" },\n    { src: \"/(.*)\", dest: `/${VERCEL_FUNCTION_NAME}` },\n  ],\n};\n\nexport const VERCEL_VC_CONFIG: unknown = {\n  runtime: \"nodejs22.x\",\n  handler: \"index.js\",\n  launcherType: \"Nodejs\",\n  shouldAddHelpers: true,\n};\n\n// Emit a Build Output API tree under `.vercel/output/`. Bundling the server\n// with esbuild produces a self-contained function bundle, so we don't ship\n// `node_modules` and don't touch tracked paths like `api/` or `public/`.\n//\n// Entry is `dist/__entry.js` — the wrapper that primes the Vite manifest via\n// `__setBuildManifest` before importing user code. Bundling `dist/server.js`\n// directly would skip that priming and 500 on view resource reads when the\n// function falls back to `readFileSync('dist/assets/.vite/manifest.json')`\n// (Vercel functions don't ship `dist/`).\nexport async function emitVercelBuildOutput(root: string): Promise<void> {\n  const outputDir = path.join(root, \".vercel\", \"output\");\n  const funcDir = path.join(\n    outputDir,\n    \"functions\",\n    `${VERCEL_FUNCTION_NAME}.func`,\n  );\n  const staticAssetsDir = path.join(outputDir, \"static\", \"assets\");\n\n  rmSync(outputDir, { recursive: true, force: true });\n  mkdirSync(funcDir, { recursive: true });\n\n  const { build } = await import(\"esbuild\");\n  await build({\n    entryPoints: [path.join(root, \"dist\", \"__entry.js\")],\n    bundle: true,\n    platform: \"node\",\n    target: \"node22\",\n    format: \"esm\",\n    outfile: path.join(funcDir, \"index.js\"),\n    // Lets esbuild DCE dev-only branches that pull in vite/devtools.\n    define: { \"process.env.NODE_ENV\": '\"production\"' },\n    // Dev-only deps reachable from re-exports; safe to leave unresolved since\n    // the code paths that touch them are eliminated by the NODE_ENV define.\n    external: [\"vite\", \"@skybridge/devtools\"],\n    banner: {\n      // ESM bundles miss CJS interop globals that some deps reach for.\n      js: \"import{createRequire}from'node:module';const require=createRequire(import.meta.url);\",\n    },\n  });\n\n  writeFileSync(\n    path.join(funcDir, \".vc-config.json\"),\n    `${JSON.stringify(VERCEL_VC_CONFIG, null, 2)}\\n`,\n  );\n  writeFileSync(\n    path.join(funcDir, \"package.json\"),\n    `${JSON.stringify({ type: \"module\" }, null, 2)}\\n`,\n  );\n\n  const assetsSrc = path.join(root, \"dist\", \"assets\");\n  if (existsSync(assetsSrc)) {\n    cpSync(assetsSrc, staticAssetsDir, { recursive: true });\n  } else {\n    mkdirSync(staticAssetsDir, { recursive: true });\n  }\n\n  writeFileSync(\n    path.join(outputDir, \"config.json\"),\n    `${JSON.stringify(VERCEL_CONFIG, null, 2)}\\n`,\n  );\n}\n"]}
+{"version":3,"file":"build-helpers.js","sourceRoot":"","sources":["../../src/cli/build-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,4EAA4E;AAC5E,gFAAgF;AAChF,wDAAwD;AACxD,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,mDAAmD;AACnD,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;CASpC,CAAC;AAEF,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,qBAAqB,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,OAAe;IACjE,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACzC,aAAa,CAAC,OAAO,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,OAAe;IAEf,MAAM,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACrD,aAAa,CAAC,OAAO,EAAE,kBAAkB,QAAQ,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,aAAa,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,MAAM,CAAC,MAAM,aAAa,GAAY;IACpC,OAAO,EAAE,CAAC;IACV,MAAM,EAAE;QACN;YACE,GAAG,EAAE,cAAc;YACnB,OAAO,EAAE,EAAE,6BAA6B,EAAE,GAAG,EAAE;YAC/C,QAAQ,EAAE,IAAI;SACf;QACD,EAAE,MAAM,EAAE,YAAY,EAAE;QACxB,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,oBAAoB,EAAE,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAY;IACvC,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,UAAU;IACnB,YAAY,EAAE,QAAQ;IACtB,gBAAgB,EAAE,IAAI;CACvB,CAAC;AAEF,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,SAAS,EACT,WAAW,EACX,GAAG,oBAAoB,OAAO,CAC/B,CAAC;IACF,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEjE,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAExC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,KAAK,CAAC;QACV,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,MAAM;QAChB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC;QACvC,iEAAiE;QACjE,MAAM,EAAE,EAAE,sBAAsB,EAAE,cAAc,EAAE;QAClD,0EAA0E;QAC1E,wEAAwE;QACxE,QAAQ,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC;QACzC,MAAM,EAAE;YACN,iEAAiE;YACjE,EAAE,EAAE,sFAAsF;SAC3F;KACF,CAAC,CAAC;IAEH,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EACrC,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC;IACF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAClC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CACnD,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EACnC,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC9C,CAAC;AACJ,CAAC","sourcesContent":["import {\n  cpSync,\n  existsSync,\n  mkdirSync,\n  readFileSync,\n  rmSync,\n  writeFileSync,\n} from \"node:fs\";\nimport path from \"node:path\";\nimport { discoverSkills } from \"../server/skills.js\";\n\n// Primes the manifest and skills snapshot in skybridge's module scope, then\n// dynamically imports `./server.js` so user code runs *after* the side channels\n// are set. The dynamic import is load-bearing: a static\n// `export { default } from ...` is hoisted with the rest of the static graph\n// and would evaluate `server.js` before the primers run. Both `skills.js` and\n// the manifest are imported (not read from disk) so they ride the bundle on\n// filesystem-less targets like Cloudflare Workers.\nexport const ENTRY_WRAPPER_CONTENT = `import { __setBuildManifest, __setSkillsManifest } from \"skybridge/server\";\nimport manifest from \"./vite-manifest.js\";\nimport skills from \"./skills.js\";\n\n__setBuildManifest(manifest);\n__setSkillsManifest(skills);\n\nconst userMod = await import(\"./server.js\");\nexport default userMod.default;\n`;\n\nexport function emitEntryWrapper(distDir: string): void {\n  writeFileSync(path.join(distDir, \"__entry.js\"), ENTRY_WRAPPER_CONTENT);\n}\n\nexport function emitSkillsModule(skillsDir: string, outPath: string): void {\n  const skills = discoverSkills(skillsDir);\n  writeFileSync(outPath, `export default ${JSON.stringify(skills)};\\n`);\n}\n\nexport function emitManifestModule(\n  manifestPath: string,\n  outPath: string,\n): void {\n  const manifest = readFileSync(manifestPath, \"utf-8\");\n  writeFileSync(outPath, `export default ${manifest};\\n`);\n}\n\n/** Emit an empty Vite manifest for view-less (headless) servers. */\nexport function emitEmptyManifestModule(outPath: string): void {\n  writeFileSync(outPath, \"export default {};\\n\");\n}\n\nexport function ensureAssetsDir(assetsDir: string): void {\n  mkdirSync(assetsDir, { recursive: true });\n}\n\nexport const VERCEL_FUNCTION_NAME = \"mcp\";\n\nexport const VERCEL_CONFIG: unknown = {\n  version: 3,\n  routes: [\n    {\n      src: \"/assets/(.*)\",\n      headers: { \"Access-Control-Allow-Origin\": \"*\" },\n      continue: true,\n    },\n    { handle: \"filesystem\" },\n    { src: \"/(.*)\", dest: `/${VERCEL_FUNCTION_NAME}` },\n  ],\n};\n\nexport const VERCEL_VC_CONFIG: unknown = {\n  runtime: \"nodejs22.x\",\n  handler: \"index.js\",\n  launcherType: \"Nodejs\",\n  shouldAddHelpers: true,\n};\n\n// Emit a Build Output API tree under `.vercel/output/`. Bundling the server\n// with esbuild produces a self-contained function bundle, so we don't ship\n// `node_modules` and don't touch tracked paths like `api/` or `public/`.\n//\n// Entry is `dist/__entry.js` — the wrapper that primes the Vite manifest via\n// `__setBuildManifest` before importing user code. Bundling `dist/server.js`\n// directly would skip that priming and 500 on view resource reads when the\n// function falls back to `readFileSync('dist/assets/.vite/manifest.json')`\n// (Vercel functions don't ship `dist/`).\nexport async function emitVercelBuildOutput(root: string): Promise<void> {\n  const outputDir = path.join(root, \".vercel\", \"output\");\n  const funcDir = path.join(\n    outputDir,\n    \"functions\",\n    `${VERCEL_FUNCTION_NAME}.func`,\n  );\n  const staticAssetsDir = path.join(outputDir, \"static\", \"assets\");\n\n  rmSync(outputDir, { recursive: true, force: true });\n  mkdirSync(funcDir, { recursive: true });\n\n  const { build } = await import(\"esbuild\");\n  await build({\n    entryPoints: [path.join(root, \"dist\", \"__entry.js\")],\n    bundle: true,\n    platform: \"node\",\n    target: \"node22\",\n    format: \"esm\",\n    outfile: path.join(funcDir, \"index.js\"),\n    // Lets esbuild DCE dev-only branches that pull in vite/devtools.\n    define: { \"process.env.NODE_ENV\": '\"production\"' },\n    // Dev-only deps reachable from re-exports; safe to leave unresolved since\n    // the code paths that touch them are eliminated by the NODE_ENV define.\n    external: [\"vite\", \"@skybridge/devtools\"],\n    banner: {\n      // ESM bundles miss CJS interop globals that some deps reach for.\n      js: \"import{createRequire}from'node:module';const require=createRequire(import.meta.url);\",\n    },\n  });\n\n  writeFileSync(\n    path.join(funcDir, \".vc-config.json\"),\n    `${JSON.stringify(VERCEL_VC_CONFIG, null, 2)}\\n`,\n  );\n  writeFileSync(\n    path.join(funcDir, \"package.json\"),\n    `${JSON.stringify({ type: \"module\" }, null, 2)}\\n`,\n  );\n\n  const assetsSrc = path.join(root, \"dist\", \"assets\");\n  if (existsSync(assetsSrc)) {\n    cpSync(assetsSrc, staticAssetsDir, { recursive: true });\n  } else {\n    mkdirSync(staticAssetsDir, { recursive: true });\n  }\n\n  writeFileSync(\n    path.join(outputDir, \"config.json\"),\n    `${JSON.stringify(VERCEL_CONFIG, null, 2)}\\n`,\n  );\n}\n"]}

package/dist/cli/build-helpers.test.js

@@ -4,7 +4,7 @@ import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync, } from
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
-import { ENTRY_WRAPPER_CONTENT, emitEmptyManifestModule, emitEntryWrapper, emitManifestModule, emitVercelBuildOutput, ensureAssetsDir, VERCEL_CONFIG, VERCEL_VC_CONFIG, } from "./build-helpers.js";
+import { ENTRY_WRAPPER_CONTENT, emitEmptyManifestModule, emitEntryWrapper, emitManifestModule, emitSkillsModule, emitVercelBuildOutput, ensureAssetsDir, VERCEL_CONFIG, VERCEL_VC_CONFIG, } from "./build-helpers.js";
 function mkTmp(prefix = "skybridge-build-helpers-") {
     return mkdtempSync(path.join(tmpdir(), prefix));
 }
@@ -14,15 +14,45 @@ describe("emitEntryWrapper", () => {
         emitEntryWrapper(dir);
         const out = readFileSync(path.join(dir, "__entry.js"), "utf-8");
         expect(out).toBe(ENTRY_WRAPPER_CONTENT);
-        expect(out).toContain('import { __setBuildManifest } from "skybridge/server"');
+        expect(out).toContain('import { __setBuildManifest, __setSkillsManifest } from "skybridge/server"');
         expect(out).toContain('import manifest from "./vite-manifest.js"');
+        expect(out).toContain('import skills from "./skills.js"');
         expect(out).toContain("__setBuildManifest(manifest)");
+        expect(out).toContain("__setSkillsManifest(skills)");
         // Dynamic import is load-bearing: `server.js` must evaluate after the
-        // setter runs, so a static re-export wouldn't work.
+        // setters run, so a static re-export wouldn't work.
         expect(out).toContain('await import("./server.js")');
         expect(out).toContain("export default userMod.default");
     });
 });
+describe("emitSkillsModule", () => {
+    it("inlines discovered skills as an ESM default export", () => {
+        const dir = mkTmp();
+        const skillsDir = path.join(dir, "src", "skills");
+        mkdirSync(path.join(skillsDir, "refunds"), { recursive: true });
+        writeFileSync(path.join(skillsDir, "refunds", "SKILL.md"), "---\nname: refunds\ndescription: Process refunds\n---\nBody");
+        const outPath = path.join(dir, "skills.js");
+        emitSkillsModule(skillsDir, outPath);
+        const out = readFileSync(outPath, "utf-8");
+        const literal = out
+            .slice("export default ".length)
+            .trim()
+            .replace(/;$/, "");
+        const skills = JSON.parse(literal);
+        expect(skills).toHaveLength(1);
+        expect(skills[0]).toMatchObject({
+            name: "refunds",
+            frontmatter: { name: "refunds", description: "Process refunds" },
+        });
+        expect(skills[0].digest).toMatch(/^sha256:[a-f0-9]{64}$/);
+    });
+    it("emits an empty array when the skills directory is absent", () => {
+        const dir = mkTmp();
+        const outPath = path.join(dir, "skills.js");
+        emitSkillsModule(path.join(dir, "nope"), outPath);
+        expect(readFileSync(outPath, "utf-8")).toBe("export default [];\n");
+    });
+});
 describe("emitManifestModule", () => {
     it("inlines the JSON manifest as an ESM default export", () => {
         const dir = mkTmp();

package/dist/cli/build-helpers.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-helpers.test.js","sourceRoot":"","sources":["../../src/cli/build-helpers.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,SAAS,KAAK,CAAC,MAAM,GAAG,0BAA0B;IAChD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CACnB,uDAAuD,CACxD,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC;QACxE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG;aAChB,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;aAC/B,IAAI,EAAE;aACN,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACnD,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnD,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3B,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EACpC,iEAAiE,CAClE,CAAC;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE;QACpE,yCAAyC;QACzC,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EACrC,iFAAiF,CAClF,CAAC;QACF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,EAChD,sBAAsB,CACvB,CAAC;QAEF,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC,CACzE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC5B,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CACtE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9B,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACzB,MAAM,CACJ,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,EACvD,OAAO,CACR,CACF,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EACrC,iFAAiF,CAClF,CAAC;QACF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EACpC,iEAAiE,CAClE,CAAC;QAEF,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,CACJ,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,UAAU,CACR,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,CACX,CACF,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\n// esbuild's invariant check on TextEncoder/Uint8Array trips jsdom's polyfill.\nimport {\n  existsSync,\n  mkdirSync,\n  mkdtempSync,\n  readFileSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\nimport { describe, expect, it } from \"vitest\";\nimport {\n  ENTRY_WRAPPER_CONTENT,\n  emitEmptyManifestModule,\n  emitEntryWrapper,\n  emitManifestModule,\n  emitVercelBuildOutput,\n  ensureAssetsDir,\n  VERCEL_CONFIG,\n  VERCEL_VC_CONFIG,\n} from \"./build-helpers.js\";\n\nfunction mkTmp(prefix = \"skybridge-build-helpers-\") {\n  return mkdtempSync(path.join(tmpdir(), prefix));\n}\n\ndescribe(\"emitEntryWrapper\", () => {\n  it(\"writes dist/__entry.js that primes the manifest before importing user code\", () => {\n    const dir = mkTmp();\n    emitEntryWrapper(dir);\n    const out = readFileSync(path.join(dir, \"__entry.js\"), \"utf-8\");\n    expect(out).toBe(ENTRY_WRAPPER_CONTENT);\n    expect(out).toContain(\n      'import { __setBuildManifest } from \"skybridge/server\"',\n    );\n    expect(out).toContain('import manifest from \"./vite-manifest.js\"');\n    expect(out).toContain(\"__setBuildManifest(manifest)\");\n    // Dynamic import is load-bearing: `server.js` must evaluate after the\n    // setter runs, so a static re-export wouldn't work.\n    expect(out).toContain('await import(\"./server.js\")');\n    expect(out).toContain(\"export default userMod.default\");\n  });\n});\n\ndescribe(\"emitManifestModule\", () => {\n  it(\"inlines the JSON manifest as an ESM default export\", () => {\n    const dir = mkTmp();\n    const inPath = path.join(dir, \"manifest.json\");\n    const outPath = path.join(dir, \"vite-manifest.js\");\n    const manifest = { \"src/views/foo.tsx\": { file: \"assets/foo-abc.js\" } };\n    writeFileSync(inPath, JSON.stringify(manifest));\n    emitManifestModule(inPath, outPath);\n    const out = readFileSync(outPath, \"utf-8\");\n    expect(out.startsWith(\"export default \")).toBe(true);\n    const literal = out\n      .slice(\"export default \".length)\n      .trim()\n      .replace(/;$/, \"\");\n    expect(JSON.parse(literal)).toEqual(manifest);\n  });\n});\n\ndescribe(\"emitEmptyManifestModule\", () => {\n  it(\"writes an empty object default export\", () => {\n    const dir = mkTmp();\n    const outPath = path.join(dir, \"vite-manifest.js\");\n    emitEmptyManifestModule(outPath);\n    expect(readFileSync(outPath, \"utf-8\")).toBe(\"export default {};\\n\");\n  });\n});\n\ndescribe(\"ensureAssetsDir\", () => {\n  it(\"creates the assets directory when missing\", () => {\n    const dir = mkTmp();\n    const assetsDir = path.join(dir, \"dist\", \"assets\");\n    ensureAssetsDir(assetsDir);\n    expect(existsSync(assetsDir)).toBe(true);\n  });\n});\n\ndescribe(\"emitVercelBuildOutput\", () => {\n  it(\"emits a Build Output API tree with bundled function and static assets\", async () => {\n    const root = mkTmp();\n    mkdirSync(path.join(root, \"dist\", \"assets\"), { recursive: true });\n    writeFileSync(\n      path.join(root, \"dist\", \"server.js\"),\n      \"export default function handler(_req, res) { res.end('ok'); }\\n\",\n    );\n    // Minimal `dist/__entry.js` (the real wrapper imports `skybridge/server`,\n    // which isn't resolvable in this test's tmp dir — the function-bundling\n    // contract we care about here is just \"bundle whatever `__entry.js`\n    // imports into a single function file\").\n    writeFileSync(\n      path.join(root, \"dist\", \"__entry.js\"),\n      \"const userMod = await import('./server.js');\\nexport default userMod.default;\\n\",\n    );\n    writeFileSync(\n      path.join(root, \"dist\", \"assets\", \"view-abc.js\"),\n      \"/* bundled view */\\n\",\n    );\n\n    await emitVercelBuildOutput(root);\n\n    const outputDir = path.join(root, \".vercel\", \"output\");\n    const funcDir = path.join(outputDir, \"functions\", \"mcp.func\");\n\n    expect(existsSync(path.join(funcDir, \"index.js\"))).toBe(true);\n    expect(\n      JSON.parse(readFileSync(path.join(funcDir, \".vc-config.json\"), \"utf-8\")),\n    ).toEqual(VERCEL_VC_CONFIG);\n    expect(\n      JSON.parse(readFileSync(path.join(funcDir, \"package.json\"), \"utf-8\")),\n    ).toEqual({ type: \"module\" });\n    expect(\n      JSON.parse(readFileSync(path.join(outputDir, \"config.json\"), \"utf-8\")),\n    ).toEqual(VERCEL_CONFIG);\n    expect(\n      readFileSync(\n        path.join(outputDir, \"static\", \"assets\", \"view-abc.js\"),\n        \"utf-8\",\n      ),\n    ).toContain(\"bundled view\");\n  });\n\n  it(\"emits static assets directory when dist/assets is missing\", async () => {\n    const root = mkTmp();\n    mkdirSync(path.join(root, \"dist\"), { recursive: true });\n    writeFileSync(\n      path.join(root, \"dist\", \"__entry.js\"),\n      \"const userMod = await import('./server.js');\\nexport default userMod.default;\\n\",\n    );\n    writeFileSync(\n      path.join(root, \"dist\", \"server.js\"),\n      \"export default function handler(_req, res) { res.end('ok'); }\\n\",\n    );\n\n    await emitVercelBuildOutput(root);\n\n    expect(\n      existsSync(path.join(root, \".vercel\", \"output\", \"static\", \"assets\")),\n    ).toBe(true);\n    expect(\n      existsSync(\n        path.join(\n          root,\n          \".vercel\",\n          \"output\",\n          \"functions\",\n          \"mcp.func\",\n          \"index.js\",\n        ),\n      ),\n    ).toBe(true);\n  });\n});\n"]}
+{"version":3,"file":"build-helpers.test.js","sourceRoot":"","sources":["../../src/cli/build-helpers.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAE5B,SAAS,KAAK,CAAC,MAAM,GAAG,0BAA0B;IAChD,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CACnB,4EAA4E,CAC7E,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACrD,sEAAsE;QACtE,oDAAoD;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAClD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,EAC3C,6DAA6D,CAC9D,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC5C,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,GAAG;aAChB,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;aAC/B,IAAI,EAAE;aACN,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAC9B,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE;SACjE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC5C,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC;QACxE,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChD,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG;aAChB,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;aAC/B,IAAI,EAAE;aACN,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACnD,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnD,eAAe,CAAC,SAAS,CAAC,CAAC;QAC3B,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EACpC,iEAAiE,CAClE,CAAC;QACF,0EAA0E;QAC1E,wEAAwE;QACxE,oEAAoE;QACpE,yCAAyC;QACzC,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EACrC,iFAAiF,CAClF,CAAC;QACF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,EAChD,sBAAsB,CACvB,CAAC;QAEF,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC,CACzE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC5B,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,CACtE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9B,MAAM,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACzB,MAAM,CACJ,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,EACvD,OAAO,CACR,CACF,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,EACrC,iFAAiF,CAClF,CAAC;QACF,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EACpC,iEAAiE,CAClE,CAAC;QAEF,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,CACJ,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CACrE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CACJ,UAAU,CACR,IAAI,CAAC,IAAI,CACP,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,CACX,CACF,CACF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\n// esbuild's invariant check on TextEncoder/Uint8Array trips jsdom's polyfill.\nimport {\n  existsSync,\n  mkdirSync,\n  mkdtempSync,\n  readFileSync,\n  writeFileSync,\n} from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport path from \"node:path\";\nimport { describe, expect, it } from \"vitest\";\nimport {\n  ENTRY_WRAPPER_CONTENT,\n  emitEmptyManifestModule,\n  emitEntryWrapper,\n  emitManifestModule,\n  emitSkillsModule,\n  emitVercelBuildOutput,\n  ensureAssetsDir,\n  VERCEL_CONFIG,\n  VERCEL_VC_CONFIG,\n} from \"./build-helpers.js\";\n\nfunction mkTmp(prefix = \"skybridge-build-helpers-\") {\n  return mkdtempSync(path.join(tmpdir(), prefix));\n}\n\ndescribe(\"emitEntryWrapper\", () => {\n  it(\"writes dist/__entry.js that primes the manifest before importing user code\", () => {\n    const dir = mkTmp();\n    emitEntryWrapper(dir);\n    const out = readFileSync(path.join(dir, \"__entry.js\"), \"utf-8\");\n    expect(out).toBe(ENTRY_WRAPPER_CONTENT);\n    expect(out).toContain(\n      'import { __setBuildManifest, __setSkillsManifest } from \"skybridge/server\"',\n    );\n    expect(out).toContain('import manifest from \"./vite-manifest.js\"');\n    expect(out).toContain('import skills from \"./skills.js\"');\n    expect(out).toContain(\"__setBuildManifest(manifest)\");\n    expect(out).toContain(\"__setSkillsManifest(skills)\");\n    // Dynamic import is load-bearing: `server.js` must evaluate after the\n    // setters run, so a static re-export wouldn't work.\n    expect(out).toContain('await import(\"./server.js\")');\n    expect(out).toContain(\"export default userMod.default\");\n  });\n});\n\ndescribe(\"emitSkillsModule\", () => {\n  it(\"inlines discovered skills as an ESM default export\", () => {\n    const dir = mkTmp();\n    const skillsDir = path.join(dir, \"src\", \"skills\");\n    mkdirSync(path.join(skillsDir, \"refunds\"), { recursive: true });\n    writeFileSync(\n      path.join(skillsDir, \"refunds\", \"SKILL.md\"),\n      \"---\\nname: refunds\\ndescription: Process refunds\\n---\\nBody\",\n    );\n    const outPath = path.join(dir, \"skills.js\");\n    emitSkillsModule(skillsDir, outPath);\n    const out = readFileSync(outPath, \"utf-8\");\n    const literal = out\n      .slice(\"export default \".length)\n      .trim()\n      .replace(/;$/, \"\");\n    const skills = JSON.parse(literal);\n    expect(skills).toHaveLength(1);\n    expect(skills[0]).toMatchObject({\n      name: \"refunds\",\n      frontmatter: { name: \"refunds\", description: \"Process refunds\" },\n    });\n    expect(skills[0].digest).toMatch(/^sha256:[a-f0-9]{64}$/);\n  });\n\n  it(\"emits an empty array when the skills directory is absent\", () => {\n    const dir = mkTmp();\n    const outPath = path.join(dir, \"skills.js\");\n    emitSkillsModule(path.join(dir, \"nope\"), outPath);\n    expect(readFileSync(outPath, \"utf-8\")).toBe(\"export default [];\\n\");\n  });\n});\n\ndescribe(\"emitManifestModule\", () => {\n  it(\"inlines the JSON manifest as an ESM default export\", () => {\n    const dir = mkTmp();\n    const inPath = path.join(dir, \"manifest.json\");\n    const outPath = path.join(dir, \"vite-manifest.js\");\n    const manifest = { \"src/views/foo.tsx\": { file: \"assets/foo-abc.js\" } };\n    writeFileSync(inPath, JSON.stringify(manifest));\n    emitManifestModule(inPath, outPath);\n    const out = readFileSync(outPath, \"utf-8\");\n    expect(out.startsWith(\"export default \")).toBe(true);\n    const literal = out\n      .slice(\"export default \".length)\n      .trim()\n      .replace(/;$/, \"\");\n    expect(JSON.parse(literal)).toEqual(manifest);\n  });\n});\n\ndescribe(\"emitEmptyManifestModule\", () => {\n  it(\"writes an empty object default export\", () => {\n    const dir = mkTmp();\n    const outPath = path.join(dir, \"vite-manifest.js\");\n    emitEmptyManifestModule(outPath);\n    expect(readFileSync(outPath, \"utf-8\")).toBe(\"export default {};\\n\");\n  });\n});\n\ndescribe(\"ensureAssetsDir\", () => {\n  it(\"creates the assets directory when missing\", () => {\n    const dir = mkTmp();\n    const assetsDir = path.join(dir, \"dist\", \"assets\");\n    ensureAssetsDir(assetsDir);\n    expect(existsSync(assetsDir)).toBe(true);\n  });\n});\n\ndescribe(\"emitVercelBuildOutput\", () => {\n  it(\"emits a Build Output API tree with bundled function and static assets\", async () => {\n    const root = mkTmp();\n    mkdirSync(path.join(root, \"dist\", \"assets\"), { recursive: true });\n    writeFileSync(\n      path.join(root, \"dist\", \"server.js\"),\n      \"export default function handler(_req, res) { res.end('ok'); }\\n\",\n    );\n    // Minimal `dist/__entry.js` (the real wrapper imports `skybridge/server`,\n    // which isn't resolvable in this test's tmp dir — the function-bundling\n    // contract we care about here is just \"bundle whatever `__entry.js`\n    // imports into a single function file\").\n    writeFileSync(\n      path.join(root, \"dist\", \"__entry.js\"),\n      \"const userMod = await import('./server.js');\\nexport default userMod.default;\\n\",\n    );\n    writeFileSync(\n      path.join(root, \"dist\", \"assets\", \"view-abc.js\"),\n      \"/* bundled view */\\n\",\n    );\n\n    await emitVercelBuildOutput(root);\n\n    const outputDir = path.join(root, \".vercel\", \"output\");\n    const funcDir = path.join(outputDir, \"functions\", \"mcp.func\");\n\n    expect(existsSync(path.join(funcDir, \"index.js\"))).toBe(true);\n    expect(\n      JSON.parse(readFileSync(path.join(funcDir, \".vc-config.json\"), \"utf-8\")),\n    ).toEqual(VERCEL_VC_CONFIG);\n    expect(\n      JSON.parse(readFileSync(path.join(funcDir, \"package.json\"), \"utf-8\")),\n    ).toEqual({ type: \"module\" });\n    expect(\n      JSON.parse(readFileSync(path.join(outputDir, \"config.json\"), \"utf-8\")),\n    ).toEqual(VERCEL_CONFIG);\n    expect(\n      readFileSync(\n        path.join(outputDir, \"static\", \"assets\", \"view-abc.js\"),\n        \"utf-8\",\n      ),\n    ).toContain(\"bundled view\");\n  });\n\n  it(\"emits static assets directory when dist/assets is missing\", async () => {\n    const root = mkTmp();\n    mkdirSync(path.join(root, \"dist\"), { recursive: true });\n    writeFileSync(\n      path.join(root, \"dist\", \"__entry.js\"),\n      \"const userMod = await import('./server.js');\\nexport default userMod.default;\\n\",\n    );\n    writeFileSync(\n      path.join(root, \"dist\", \"server.js\"),\n      \"export default function handler(_req, res) { res.end('ok'); }\\n\",\n    );\n\n    await emitVercelBuildOutput(root);\n\n    expect(\n      existsSync(path.join(root, \".vercel\", \"output\", \"static\", \"assets\")),\n    ).toBe(true);\n    expect(\n      existsSync(\n        path.join(\n          root,\n          \".vercel\",\n          \"output\",\n          \"functions\",\n          \"mcp.func\",\n          \"index.js\",\n        ),\n      ),\n    ).toBe(true);\n  });\n});\n"]}

package/dist/cli/build-steps.js

@@ -1,7 +1,7 @@
 import { rmSync, writeFileSync } from "node:fs";
 import path, { isAbsolute, resolve } from "node:path";
 import { scanAndWriteViewsDts, scanViewsSync, } from "../web/plugin/scan-views.js";
-import { emitEmptyManifestModule, emitEntryWrapper, emitManifestModule, emitVercelBuildOutput, ensureAssetsDir, } from "./build-helpers.js";
+import { emitEmptyManifestModule, emitEntryWrapper, emitManifestModule, emitSkillsModule, emitVercelBuildOutput, ensureAssetsDir, } from "./build-helpers.js";
 import { resolveViewsDir } from "./resolve-views-dir.js";
 export async function getCommandSteps(root = process.cwd()) {
     const viewsDir = await resolveViewsDir(root);
@@ -40,6 +40,11 @@ export async function getCommandSteps(root = process.cwd()) {
                 emitEmptyManifestModule(manifestOut);
             }
         },
+    }, {
+        label: "Emitting skills module",
+        run: () => {
+            emitSkillsModule(resolve(root, "src/skills"), path.join(root, "dist", "skills.js"));
+        },
     }, {
         label: "Emitting entry wrapper",
         run: () => {

package/dist/cli/build-steps.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-steps.js","sourceRoot":"","sources":["../../src/cli/build-steps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,aAAa,GACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IAEpB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,IAAI,WAAW,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAE7D,MAAM,KAAK,GAAkB;QAC3B;YACE,KAAK,EAAE,gBAAgB;YACvB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;SACF;QACD;YACE,KAAK,EAAE,kBAAkB;YACzB,GAAG,EAAE,GAAG,EAAE,CACR,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACnE,OAAO,EAAE,gBAAgB;SAC1B;KACF,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CACR;QACE,KAAK,EAAE,0BAA0B;QACjC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAChE,IAAI,QAAQ,EAAE,CAAC;gBACb,kBAAkB,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAC3D,WAAW,CACZ,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;KACF,EACD;QACE,KAAK,EAAE,wBAAwB;QAC/B,GAAG,EAAE,GAAG,EAAE;YACR,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;KACF,EACD;QACE,KAAK,EAAE,+BAA+B;QACtC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,eAAe,CAAC,SAAS,CAAC,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAClC,uCAAuC,CACxC,CAAC;QACJ,CAAC;KACF,EACD;QACE,KAAK,EAAE,6BAA6B;QACpC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,eAAe,CAAC,SAAS,CAAC,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAChC,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF,EACD;QACE,KAAK,EAAE,8BAA8B;QACrC,GAAG,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;KACvC,CACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { rmSync, writeFileSync } from \"node:fs\";\nimport path, { isAbsolute, resolve } from \"node:path\";\nimport {\n  scanAndWriteViewsDts,\n  scanViewsSync,\n} from \"../web/plugin/scan-views.js\";\nimport {\n  emitEmptyManifestModule,\n  emitEntryWrapper,\n  emitManifestModule,\n  emitVercelBuildOutput,\n  ensureAssetsDir,\n} from \"./build-helpers.js\";\nimport { resolveViewsDir } from \"./resolve-views-dir.js\";\nimport type { CommandStep } from \"./use-execute-steps.js\";\n\nexport async function getCommandSteps(\n  root = process.cwd(),\n): Promise<CommandStep[]> {\n  const viewsDir = await resolveViewsDir(root);\n  const rawDir = viewsDir ?? \"src/views\";\n  const resolvedDir = isAbsolute(rawDir) ? rawDir : resolve(root, rawDir);\n  // Non-throwing pre-check: duplicate view names are validated in the\n  // \"Scanning views\" step so useExecuteSteps can render a styled error.\n  const hasViews = scanViewsSync(resolvedDir).valid.length > 0;\n\n  const steps: CommandStep[] = [\n    {\n      label: \"Scanning views\",\n      run: async () => {\n        scanAndWriteViewsDts(root, viewsDir);\n      },\n    },\n    {\n      label: \"Compiling server\",\n      run: () =>\n        rmSync(path.join(root, \"dist\"), { recursive: true, force: true }),\n      command: \"tsc -b --force\",\n    },\n  ];\n\n  if (hasViews) {\n    steps.push({\n      label: \"Building views\",\n      command: \"vite build\",\n    });\n  }\n\n  steps.push(\n    {\n      label: \"Emitting manifest module\",\n      run: () => {\n        const manifestOut = path.join(root, \"dist\", \"vite-manifest.js\");\n        if (hasViews) {\n          emitManifestModule(\n            path.join(root, \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n            manifestOut,\n          );\n        } else {\n          emitEmptyManifestModule(manifestOut);\n        }\n      },\n    },\n    {\n      label: \"Emitting entry wrapper\",\n      run: () => {\n        emitEntryWrapper(path.join(root, \"dist\"));\n      },\n    },\n    {\n      label: \"Emitting Cloudflare redirects\",\n      run: () => {\n        const assetsDir = path.join(root, \"dist\", \"assets\");\n        ensureAssetsDir(assetsDir);\n        writeFileSync(\n          path.join(assetsDir, \"_redirects\"),\n          \"/assets/assets/* /assets/:splat 200\\n\",\n        );\n      },\n    },\n    {\n      label: \"Emitting Cloudflare headers\",\n      run: () => {\n        const assetsDir = path.join(root, \"dist\", \"assets\");\n        ensureAssetsDir(assetsDir);\n        writeFileSync(\n          path.join(assetsDir, \"_headers\"),\n          \"/assets/*\\n  Access-Control-Allow-Origin: *\\n\",\n        );\n      },\n    },\n    {\n      label: \"Emitting Vercel build output\",\n      run: () => emitVercelBuildOutput(root),\n    },\n  );\n\n  return steps;\n}\n"]}
+{"version":3,"file":"build-steps.js","sourceRoot":"","sources":["../../src/cli/build-steps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,aAAa,GACd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IAEpB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,QAAQ,IAAI,WAAW,CAAC;IACvC,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAE7D,MAAM,KAAK,GAAkB;QAC3B;YACE,KAAK,EAAE,gBAAgB;YACvB,GAAG,EAAE,KAAK,IAAI,EAAE;gBACd,oBAAoB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,CAAC;SACF;QACD;YACE,KAAK,EAAE,kBAAkB;YACzB,GAAG,EAAE,GAAG,EAAE,CACR,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACnE,OAAO,EAAE,gBAAgB;SAC1B;KACF,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,YAAY;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CACR;QACE,KAAK,EAAE,0BAA0B;QACjC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAChE,IAAI,QAAQ,EAAE,CAAC;gBACb,kBAAkB,CAChB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EAC3D,WAAW,CACZ,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,uBAAuB,CAAC,WAAW,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;KACF,EACD;QACE,KAAK,EAAE,wBAAwB;QAC/B,GAAG,EAAE,GAAG,EAAE;YACR,gBAAgB,CACd,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,EAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CACrC,CAAC;QACJ,CAAC;KACF,EACD;QACE,KAAK,EAAE,wBAAwB;QAC/B,GAAG,EAAE,GAAG,EAAE;YACR,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,CAAC;KACF,EACD;QACE,KAAK,EAAE,+BAA+B;QACtC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,eAAe,CAAC,SAAS,CAAC,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAClC,uCAAuC,CACxC,CAAC;QACJ,CAAC;KACF,EACD;QACE,KAAK,EAAE,6BAA6B;QACpC,GAAG,EAAE,GAAG,EAAE;YACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,eAAe,CAAC,SAAS,CAAC,CAAC;YAC3B,aAAa,CACX,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAChC,+CAA+C,CAChD,CAAC;QACJ,CAAC;KACF,EACD;QACE,KAAK,EAAE,8BAA8B;QACrC,GAAG,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;KACvC,CACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["import { rmSync, writeFileSync } from \"node:fs\";\nimport path, { isAbsolute, resolve } from \"node:path\";\nimport {\n  scanAndWriteViewsDts,\n  scanViewsSync,\n} from \"../web/plugin/scan-views.js\";\nimport {\n  emitEmptyManifestModule,\n  emitEntryWrapper,\n  emitManifestModule,\n  emitSkillsModule,\n  emitVercelBuildOutput,\n  ensureAssetsDir,\n} from \"./build-helpers.js\";\nimport { resolveViewsDir } from \"./resolve-views-dir.js\";\nimport type { CommandStep } from \"./use-execute-steps.js\";\n\nexport async function getCommandSteps(\n  root = process.cwd(),\n): Promise<CommandStep[]> {\n  const viewsDir = await resolveViewsDir(root);\n  const rawDir = viewsDir ?? \"src/views\";\n  const resolvedDir = isAbsolute(rawDir) ? rawDir : resolve(root, rawDir);\n  // Non-throwing pre-check: duplicate view names are validated in the\n  // \"Scanning views\" step so useExecuteSteps can render a styled error.\n  const hasViews = scanViewsSync(resolvedDir).valid.length > 0;\n\n  const steps: CommandStep[] = [\n    {\n      label: \"Scanning views\",\n      run: async () => {\n        scanAndWriteViewsDts(root, viewsDir);\n      },\n    },\n    {\n      label: \"Compiling server\",\n      run: () =>\n        rmSync(path.join(root, \"dist\"), { recursive: true, force: true }),\n      command: \"tsc -b --force\",\n    },\n  ];\n\n  if (hasViews) {\n    steps.push({\n      label: \"Building views\",\n      command: \"vite build\",\n    });\n  }\n\n  steps.push(\n    {\n      label: \"Emitting manifest module\",\n      run: () => {\n        const manifestOut = path.join(root, \"dist\", \"vite-manifest.js\");\n        if (hasViews) {\n          emitManifestModule(\n            path.join(root, \"dist\", \"assets\", \".vite\", \"manifest.json\"),\n            manifestOut,\n          );\n        } else {\n          emitEmptyManifestModule(manifestOut);\n        }\n      },\n    },\n    {\n      label: \"Emitting skills module\",\n      run: () => {\n        emitSkillsModule(\n          resolve(root, \"src/skills\"),\n          path.join(root, \"dist\", \"skills.js\"),\n        );\n      },\n    },\n    {\n      label: \"Emitting entry wrapper\",\n      run: () => {\n        emitEntryWrapper(path.join(root, \"dist\"));\n      },\n    },\n    {\n      label: \"Emitting Cloudflare redirects\",\n      run: () => {\n        const assetsDir = path.join(root, \"dist\", \"assets\");\n        ensureAssetsDir(assetsDir);\n        writeFileSync(\n          path.join(assetsDir, \"_redirects\"),\n          \"/assets/assets/* /assets/:splat 200\\n\",\n        );\n      },\n    },\n    {\n      label: \"Emitting Cloudflare headers\",\n      run: () => {\n        const assetsDir = path.join(root, \"dist\", \"assets\");\n        ensureAssetsDir(assetsDir);\n        writeFileSync(\n          path.join(assetsDir, \"_headers\"),\n          \"/assets/*\\n  Access-Control-Allow-Origin: *\\n\",\n        );\n      },\n    },\n    {\n      label: \"Emitting Vercel build output\",\n      run: () => emitVercelBuildOutput(root),\n    },\n  );\n\n  return steps;\n}\n"]}

package/dist/cli/use-execute-steps.d.ts

@@ -5,7 +5,7 @@ export interface CommandStep {
 }
 export declare const useExecuteSteps: (steps: CommandStep[]) => {
     currentStep: number;
-    status: "error" | "running" | "success";
+    status: "error" | "success" | "running";
     error: string | null;
     execute: () => Promise<void>;
 };

package/dist/cli/use-nodemon.js

@@ -17,7 +17,7 @@ export function startNodemon(env, handlers) {
         }
         : {
             watch: ["src"],
-            ext: "ts,json",
+            ext: "ts,json,md",
             exec: "tsx src/server.ts",
         };
     nodemon({ ...config, env, stdout: false });

package/dist/cli/use-nodemon.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-nodemon.js","sourceRoot":"","sources":["../../src/cli/use-nodemon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,eAAe,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAIlC,MAAM,OAAO,GAAG,eAAkC,CAAC;AAEnD,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AAWhF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAsB,EACtB,QAAyB;IAEzB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC;YACE,UAAU;SACX;QACH,CAAC,CAAC;YACE,KAAK,EAAE,CAAC,KAAK,CAAC;YACd,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,mBAAmB;SAC1B,CAAC;IAEN,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3C,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,EAAE;QACzC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,OAAO;aACrB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,GAAG,EAAE;QAC/B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,GAAG,EAAE;QAC/B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;QAC1B,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAe,EAAE,EAAE;QACxC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1B,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,EAAE;QACV,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,GAAsB,EACtB,WAAwB;IAExB,SAAS,CACP,GAAG,EAAE,CACH,YAAY,CAAC,GAAG,EAAE;QAChB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QACpD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,WAAW,CACT,yCAAyC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3D,SAAS,CACV;KACJ,CAAC,EACJ,CAAC,GAAG,EAAE,WAAW,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport nodemonOriginal from \"nodemon\";\nimport { useEffect } from \"react\";\nimport type { ExtendedNodemon } from \"./nodemon.d.ts\";\nimport type { PushMessage } from \"./use-messages.js\";\n\nconst nodemon = nodemonOriginal as ExtendedNodemon;\n\nconst SOURCEMAP_WARNING = /^Sourcemap for \".*\" points to missing source files$/;\n\nexport interface NodemonHandlers {\n  /** A raw chunk of server stdout, forwarded untouched. */\n  onStdout: (chunk: Buffer) => void;\n  /** A (filtered) chunk of server stderr. */\n  onStderr: (message: string) => void;\n  /** The server restarted because the listed files changed. */\n  onRestart: (files: string[]) => void;\n}\n\n/**\n * Boot nodemon and wire its stdout/stderr to the provided handlers. Returns a\n * cleanup function that detaches the listeners and quits nodemon. Shared by the\n * Ink-based dev UI (via {@link useNodemon}) and the `--plain` runner.\n */\nexport function startNodemon(\n  env: NodeJS.ProcessEnv,\n  handlers: NodemonHandlers,\n): () => void {\n  const configFile = resolve(process.cwd(), \"nodemon.json\");\n\n  const config = existsSync(configFile)\n    ? {\n        configFile,\n      }\n    : {\n        watch: [\"src\"],\n        ext: \"ts,json\",\n        exec: \"tsx src/server.ts\",\n      };\n\n  nodemon({ ...config, env, stdout: false });\n\n  const handleStdoutData = (chunk: Buffer) => {\n    handlers.onStdout(chunk);\n  };\n\n  const handleStderrData = (chunk: Buffer) => {\n    const message = chunk.toString().trim();\n    if (!message) {\n      return;\n    }\n    // Node's source-map warnings for third-party deps (superjson, @mcp/sdk, …) — not actionable.\n    const filtered = message\n      .split(\"\\n\")\n      .filter((line) => !SOURCEMAP_WARNING.test(line))\n      .join(\"\\n\");\n    if (filtered) {\n      handlers.onStderr(filtered);\n    }\n  };\n\n  const setupStdoutListener = () => {\n    if (nodemon.stdout) {\n      nodemon.stdout.off(\"data\", handleStdoutData);\n      nodemon.stdout.on(\"data\", handleStdoutData);\n    }\n  };\n\n  const setupStderrListener = () => {\n    if (nodemon.stderr) {\n      nodemon.stderr.off(\"data\", handleStderrData);\n      nodemon.stderr.on(\"data\", handleStderrData);\n    }\n  };\n\n  nodemon.on(\"readable\", () => {\n    setupStdoutListener();\n    setupStderrListener();\n  });\n\n  nodemon.on(\"restart\", (files: string[]) => {\n    handlers.onRestart(files);\n    setupStdoutListener();\n    setupStderrListener();\n  });\n\n  return () => {\n    if (nodemon.stdout) {\n      nodemon.stdout.off(\"data\", handleStdoutData);\n    }\n    if (nodemon.stderr) {\n      nodemon.stderr.off(\"data\", handleStderrData);\n    }\n    nodemon.emit(\"quit\");\n  };\n}\n\nexport function useNodemon(\n  env: NodeJS.ProcessEnv,\n  pushMessage: PushMessage,\n): void {\n  useEffect(\n    () =>\n      startNodemon(env, {\n        onStdout: (chunk) => {\n          const message = chunk.toString().trim();\n          if (message) {\n            pushMessage(message, \"log\");\n          }\n        },\n        onStderr: (message) => pushMessage(message, \"error\"),\n        onRestart: (files) =>\n          pushMessage(\n            `Server restarted due to file changes: ${files.join(\", \")}`,\n            \"restart\",\n          ),\n      }),\n    [env, pushMessage],\n  );\n}\n"]}
+{"version":3,"file":"use-nodemon.js","sourceRoot":"","sources":["../../src/cli/use-nodemon.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,eAAe,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAIlC,MAAM,OAAO,GAAG,eAAkC,CAAC;AAEnD,MAAM,iBAAiB,GAAG,qDAAqD,CAAC;AAWhF;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAsB,EACtB,QAAyB;IAEzB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC;YACE,UAAU;SACX;QACH,CAAC,CAAC;YACE,KAAK,EAAE,CAAC,KAAK,CAAC;YACd,GAAG,EAAE,YAAY;YACjB,IAAI,EAAE,mBAAmB;SAC1B,CAAC;IAEN,OAAO,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAE3C,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,EAAE;QACzC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,KAAa,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,OAAO;aACrB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAC/C,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,GAAG,EAAE;QAC/B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,mBAAmB,GAAG,GAAG,EAAE;QAC/B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE;QAC1B,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAe,EAAE,EAAE;QACxC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1B,mBAAmB,EAAE,CAAC;QACtB,mBAAmB,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,EAAE;QACV,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,GAAsB,EACtB,WAAwB;IAExB,SAAS,CACP,GAAG,EAAE,CACH,YAAY,CAAC,GAAG,EAAE;QAChB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC;QACpD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CACnB,WAAW,CACT,yCAAyC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3D,SAAS,CACV;KACJ,CAAC,EACJ,CAAC,GAAG,EAAE,WAAW,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport nodemonOriginal from \"nodemon\";\nimport { useEffect } from \"react\";\nimport type { ExtendedNodemon } from \"./nodemon.d.ts\";\nimport type { PushMessage } from \"./use-messages.js\";\n\nconst nodemon = nodemonOriginal as ExtendedNodemon;\n\nconst SOURCEMAP_WARNING = /^Sourcemap for \".*\" points to missing source files$/;\n\nexport interface NodemonHandlers {\n  /** A raw chunk of server stdout, forwarded untouched. */\n  onStdout: (chunk: Buffer) => void;\n  /** A (filtered) chunk of server stderr. */\n  onStderr: (message: string) => void;\n  /** The server restarted because the listed files changed. */\n  onRestart: (files: string[]) => void;\n}\n\n/**\n * Boot nodemon and wire its stdout/stderr to the provided handlers. Returns a\n * cleanup function that detaches the listeners and quits nodemon. Shared by the\n * Ink-based dev UI (via {@link useNodemon}) and the `--plain` runner.\n */\nexport function startNodemon(\n  env: NodeJS.ProcessEnv,\n  handlers: NodemonHandlers,\n): () => void {\n  const configFile = resolve(process.cwd(), \"nodemon.json\");\n\n  const config = existsSync(configFile)\n    ? {\n        configFile,\n      }\n    : {\n        watch: [\"src\"],\n        ext: \"ts,json,md\",\n        exec: \"tsx src/server.ts\",\n      };\n\n  nodemon({ ...config, env, stdout: false });\n\n  const handleStdoutData = (chunk: Buffer) => {\n    handlers.onStdout(chunk);\n  };\n\n  const handleStderrData = (chunk: Buffer) => {\n    const message = chunk.toString().trim();\n    if (!message) {\n      return;\n    }\n    // Node's source-map warnings for third-party deps (superjson, @mcp/sdk, …) — not actionable.\n    const filtered = message\n      .split(\"\\n\")\n      .filter((line) => !SOURCEMAP_WARNING.test(line))\n      .join(\"\\n\");\n    if (filtered) {\n      handlers.onStderr(filtered);\n    }\n  };\n\n  const setupStdoutListener = () => {\n    if (nodemon.stdout) {\n      nodemon.stdout.off(\"data\", handleStdoutData);\n      nodemon.stdout.on(\"data\", handleStdoutData);\n    }\n  };\n\n  const setupStderrListener = () => {\n    if (nodemon.stderr) {\n      nodemon.stderr.off(\"data\", handleStderrData);\n      nodemon.stderr.on(\"data\", handleStderrData);\n    }\n  };\n\n  nodemon.on(\"readable\", () => {\n    setupStdoutListener();\n    setupStderrListener();\n  });\n\n  nodemon.on(\"restart\", (files: string[]) => {\n    handlers.onRestart(files);\n    setupStdoutListener();\n    setupStderrListener();\n  });\n\n  return () => {\n    if (nodemon.stdout) {\n      nodemon.stdout.off(\"data\", handleStdoutData);\n    }\n    if (nodemon.stderr) {\n      nodemon.stderr.off(\"data\", handleStderrData);\n    }\n    nodemon.emit(\"quit\");\n  };\n}\n\nexport function useNodemon(\n  env: NodeJS.ProcessEnv,\n  pushMessage: PushMessage,\n): void {\n  useEffect(\n    () =>\n      startNodemon(env, {\n        onStdout: (chunk) => {\n          const message = chunk.toString().trim();\n          if (message) {\n            pushMessage(message, \"log\");\n          }\n        },\n        onStderr: (message) => pushMessage(message, \"error\"),\n        onRestart: (files) =>\n          pushMessage(\n            `Server restarted due to file changes: ${files.join(\", \")}`,\n            \"restart\",\n          ),\n      }),\n    [env, pushMessage],\n  );\n}\n"]}

package/dist/server/auth/providers/custom.d.ts

@@ -16,6 +16,12 @@ export type CustomProviderOptions = {
      * injects the registration endpoint). Use the static public URL; `verify.issuer`
      * stays the IdP (the token's real `iss`). */
     serverUrl?: string;
+    /** Advertise this URL as the authorization server (served AS metadata `issuer`
+     * and PRM `authorization_servers`) while `verify.issuer` stays the IdP's `iss`.
+     * Use when DCR/authorize/token live at a different URL than the token issuer
+     * (e.g. Descope's agentic URL vs. its base-project issuer). `serverUrl` wins if
+     * both are set. */
+    authorizationServer?: string;
     scopes?: string[];
     requiredScopes?: string[];
     metadataOverrides?: Omit<Partial<OAuthMetadata>, "issuer">;

package/dist/server/auth/providers/custom.js

@@ -13,12 +13,15 @@ export async function customProvider(opts) {
     const { issuer: _issuer, jwks_uri: _jwks, ...overrides } = opts.metadataOverrides ?? {};
     const base = { ...discovered, ...overrides };
     const scopesSupported = opts.scopes ?? base.scopes_supported;
-    // serverUrl => skybridge-as-AS: advertise this server's URL as the issuer (and
-    // keep the served scopes in sync). The verifier still trusts the IdP's `iss`.
-    const oauthMetadata = opts.serverUrl
+    // serverUrl (skybridge-as-AS) or authorizationServer (a distinct AS URL)
+    // override the advertised issuer (and keep the served scopes in sync). The
+    // verifier still trusts the IdP's `iss`. serverUrl wins when both are set.
+    const advertisedIssuer = opts.serverUrl?.replace(/\/$/, "") ??
+        opts.authorizationServer?.replace(/\/$/, "");
+    const oauthMetadata = advertisedIssuer
         ? {
             ...base,
-            issuer: opts.serverUrl.replace(/\/$/, ""),
+            issuer: advertisedIssuer,
             scopes_supported: scopesSupported,
         }
         : base;

package/dist/server/auth/providers/custom.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAwBzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAE7D,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,aAAa,GAAuB,IAAI,CAAC,SAAS;QACtD,CAAC,CAAC;YACE,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACzC,gBAAgB,EAAE,eAAe;SAClC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B;QACD,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  /** Advertise THIS server as the authorization server (skybridge-as-AS): the\n   * served AS metadata `issuer` and the PRM `authorization_servers` use this URL\n   * instead of the IdP's. Needed when skybridge must sit in the auth path — Auth0\n   * (the `audience` must be baked into `/authorize`) or the Alpic DCR proxy (Alpic\n   * injects the registration endpoint). Use the static public URL; `verify.issuer`\n   * stays the IdP (the token's real `iss`). */\n  serverUrl?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/** Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document. */\nexport async function customProvider(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // JWKS verification needs a signing-key URL; without it the server can't verify\n  // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply\n  // omits it; a proxy like Alpic, or pre-registered clients, supply registration.)\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)\n  // always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  const base: DiscoveredMetadata = { ...discovered, ...overrides };\n  const scopesSupported = opts.scopes ?? base.scopes_supported;\n\n  // serverUrl => skybridge-as-AS: advertise this server's URL as the issuer (and\n  // keep the served scopes in sync). The verifier still trusts the IdP's `iss`.\n  const oauthMetadata: DiscoveredMetadata = opts.serverUrl\n    ? {\n        ...base,\n        issuer: opts.serverUrl.replace(/\\/$/, \"\"),\n        scopes_supported: scopesSupported,\n      }\n    : base;\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer: discovered.issuer,\n      audience: opts.audience,\n      jwksUri: discovered.jwks_uri,\n    },\n    scopesSupported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AA8BzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAA2B;IAE3B,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElE,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,yCAAyC;IACzC,MAAM,EACJ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,KAAK,EACf,GAAG,SAAS,EACb,GAAgC,IAAI,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAuB,EAAE,GAAG,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;IACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAE7D,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,gBAAgB,GACpB,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,mBAAmB,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAuB,gBAAgB;QACxD,CAAC,CAAC;YACE,GAAG,IAAI;YACP,MAAM,EAAE,gBAAgB;YACxB,gBAAgB,EAAE,eAAe;SAClC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,UAAU,CAAC,QAAQ;SAC7B;QACD,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Options accepted by {@link customProvider} and the branded providers. */\nexport type CustomProviderOptions = {\n  issuer: string;\n  /** Expected token `aud`. Omit to skip audience verification — only for IdPs\n   * that don't bind an audience (e.g. Clerk). Branded providers whose IdP does\n   * bind an audience re-require it in their own options. */\n  audience?: string;\n  /** Omit to let the server infer the resource origin from request headers. */\n  baseUrl?: string;\n  /** Advertise THIS server as the authorization server (skybridge-as-AS): the\n   * served AS metadata `issuer` and the PRM `authorization_servers` use this URL\n   * instead of the IdP's. Needed when skybridge must sit in the auth path — Auth0\n   * (the `audience` must be baked into `/authorize`) or the Alpic DCR proxy (Alpic\n   * injects the registration endpoint). Use the static public URL; `verify.issuer`\n   * stays the IdP (the token's real `iss`). */\n  serverUrl?: string;\n  /** Advertise this URL as the authorization server (served AS metadata `issuer`\n   * and PRM `authorization_servers`) while `verify.issuer` stays the IdP's `iss`.\n   * Use when DCR/authorize/token live at a different URL than the token issuer\n   * (e.g. Descope's agentic URL vs. its base-project issuer). `serverUrl` wins if\n   * both are set. */\n  authorizationServer?: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  metadataOverrides?: Omit<Partial<OAuthMetadata>, \"issuer\">;\n};\n\n/** Builds a complete {@link OAuthConfig} from an IdP's OAuth discovery document. */\nexport async function customProvider(\n  opts: CustomProviderOptions,\n): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n\n  // JWKS verification needs a signing-key URL; without it the server can't verify\n  // tokens. (`registration_endpoint` is optional per RFC 8414 — a no-DCR IdP simply\n  // omits it; a proxy like Alpic, or pre-registered clients, supply registration.)\n  if (!discovered.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  // Overrides adjust only advertised metadata; the trust anchor (issuer, jwks_uri)\n  // always comes from validated discovery.\n  const {\n    issuer: _issuer,\n    jwks_uri: _jwks,\n    ...overrides\n  }: Partial<DiscoveredMetadata> = opts.metadataOverrides ?? {};\n  const base: DiscoveredMetadata = { ...discovered, ...overrides };\n  const scopesSupported = opts.scopes ?? base.scopes_supported;\n\n  // serverUrl (skybridge-as-AS) or authorizationServer (a distinct AS URL)\n  // override the advertised issuer (and keep the served scopes in sync). The\n  // verifier still trusts the IdP's `iss`. serverUrl wins when both are set.\n  const advertisedIssuer =\n    opts.serverUrl?.replace(/\\/$/, \"\") ??\n    opts.authorizationServer?.replace(/\\/$/, \"\");\n  const oauthMetadata: DiscoveredMetadata = advertisedIssuer\n    ? {\n        ...base,\n        issuer: advertisedIssuer,\n        scopes_supported: scopesSupported,\n      }\n    : base;\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer: discovered.issuer,\n      audience: opts.audience,\n      jwksUri: discovered.jwks_uri,\n    },\n    scopesSupported,\n    requiredScopes: opts.requiredScopes,\n  };\n}\n"]}

package/dist/server/auth/providers/custom.test.js

@@ -93,6 +93,27 @@ describe("customProvider", () => {
         // but the token's issuer is still verified against the IdP.
         expect(config.verify.issuer).toBe(base);
     });
+    it("authorizationServer advertises a distinct AS, keeping the discovered issuer for verification", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            authorizationServer: "https://as.example.test/agentic/P1/MS1/",
+        });
+        expect(config.oauthMetadata.issuer).toBe("https://as.example.test/agentic/P1/MS1");
+        expect(config.verify.issuer).toBe(base);
+    });
+    it("serverUrl takes precedence over authorizationServer", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            serverUrl: "https://app.example.test/",
+            authorizationServer: "https://as.example.test/agentic/P1/MS1",
+        });
+        expect(config.oauthMetadata.issuer).toBe("https://app.example.test");
+        expect(config.verify.issuer).toBe(base);
+    });
     it("applies metadataOverrides over discovered values", async () => {
         const base = await serveDiscovery();
         const config = await customProvider({

package/dist/server/auth/providers/custom.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAiC,EAAE;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAW;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAW;SACnE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CACV,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAChD,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QACH,uDAAuD;QACvD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,4DAA4D;QAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves the discovery doc (built from the live origin) at the OIDC well-known path.\nasync function serveDiscovery(extra: Record<string, unknown> = {}) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc(origin, extra)));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery();\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n    });\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(config.verify).toEqual({\n      issuer: base,\n      audience: \"my-api\",\n      jwksUri: `${base}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"ignores a runtime issuer override (keeps the discovered trust anchor)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { issuer: \"https://evil.test\" } as never,\n    });\n    expect(config.verify.issuer).toBe(base);\n    expect(config.oauthMetadata.issuer).toBe(base);\n  });\n\n  it(\"ignores a runtime jwks_uri override (keeps the discovered signing keys)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { jwks_uri: \"https://evil.test/keys\" } as never,\n    });\n    expect(config.verify.jwksUri).toBe(`${base}/jwks`);\n  });\n\n  it(\"serves metadata without a registration_endpoint when the IdP has no DCR\", async () => {\n    const base = await serveDiscovery({ registration_endpoint: undefined });\n    const config = await customProvider({ issuer: base, audience: \"a\" });\n    expect(config.oauthMetadata.registration_endpoint).toBeUndefined();\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"throws when discovery has no jwks_uri (token verification needs it)\", async () => {\n    const base = await serveDiscovery({ jwks_uri: undefined });\n    await expect(\n      customProvider({ issuer: base, audience: \"a\" }),\n    ).rejects.toThrow(/jwks_uri/);\n  });\n\n  it(\"serverUrl advertises this server as the AS, keeping the IdP as the token issuer\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      scopes: [\"openid\"],\n    });\n    // AS metadata + advertised scopes reflect this server.\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.scopes_supported).toEqual([\"openid\"]);\n    // but the token's issuer is still verified against the IdP.\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    });\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}
+{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAiC,EAAE;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAW;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,iBAAiB,EAAE,EAAE,QAAQ,EAAE,wBAAwB,EAAW;SACnE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,aAAa,EAAE,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,MAAM,MAAM,CACV,cAAc,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAChD,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,MAAM,EAAE,CAAC,QAAQ,CAAC;SACnB,CAAC,CAAC;QACH,uDAAuD;QACvD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAClE,4DAA4D;QAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,mBAAmB,EAAE,yCAAyC;SAC/D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CACtC,wCAAwC,CACzC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,2BAA2B;YACtC,mBAAmB,EAAE,wCAAwC;SAC9D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves the discovery doc (built from the live origin) at the OIDC well-known path.\nasync function serveDiscovery(extra: Record<string, unknown> = {}) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc(origin, extra)));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery();\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n    });\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(config.verify).toEqual({\n      issuer: base,\n      audience: \"my-api\",\n      jwksUri: `${base}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"ignores a runtime issuer override (keeps the discovered trust anchor)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { issuer: \"https://evil.test\" } as never,\n    });\n    expect(config.verify.issuer).toBe(base);\n    expect(config.oauthMetadata.issuer).toBe(base);\n  });\n\n  it(\"ignores a runtime jwks_uri override (keeps the discovered signing keys)\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      metadataOverrides: { jwks_uri: \"https://evil.test/keys\" } as never,\n    });\n    expect(config.verify.jwksUri).toBe(`${base}/jwks`);\n  });\n\n  it(\"serves metadata without a registration_endpoint when the IdP has no DCR\", async () => {\n    const base = await serveDiscovery({ registration_endpoint: undefined });\n    const config = await customProvider({ issuer: base, audience: \"a\" });\n    expect(config.oauthMetadata.registration_endpoint).toBeUndefined();\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"throws when discovery has no jwks_uri (token verification needs it)\", async () => {\n    const base = await serveDiscovery({ jwks_uri: undefined });\n    await expect(\n      customProvider({ issuer: base, audience: \"a\" }),\n    ).rejects.toThrow(/jwks_uri/);\n  });\n\n  it(\"serverUrl advertises this server as the AS, keeping the IdP as the token issuer\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      scopes: [\"openid\"],\n    });\n    // AS metadata + advertised scopes reflect this server.\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.oauthMetadata.scopes_supported).toEqual([\"openid\"]);\n    // but the token's issuer is still verified against the IdP.\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"authorizationServer advertises a distinct AS, keeping the discovered issuer for verification\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      authorizationServer: \"https://as.example.test/agentic/P1/MS1/\",\n    });\n    expect(config.oauthMetadata.issuer).toBe(\n      \"https://as.example.test/agentic/P1/MS1\",\n    );\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"serverUrl takes precedence over authorizationServer\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      serverUrl: \"https://app.example.test/\",\n      authorizationServer: \"https://as.example.test/agentic/P1/MS1\",\n    });\n    expect(config.oauthMetadata.issuer).toBe(\"https://app.example.test\");\n    expect(config.verify.issuer).toBe(base);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    });\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}

package/dist/server/auth/providers/descope.js

@@ -23,10 +23,12 @@ function projectIdFromUrl(url) {
  */
 export function descopeProvider(opts) {
     const { url, audience, ...rest } = opts;
-    const issuer = url.replace(/\/\.well-known\/[^?#]*$/, "").replace(/\/$/, "");
+    const projectId = projectIdFromUrl(url);
+    const issuer = `${url.slice(0, url.indexOf("/agentic/"))}/${projectId}`;
     return customProvider({
         issuer,
-        audience: audience ?? projectIdFromUrl(issuer),
+        audience: audience ?? projectId,
+        authorizationServer: url,
         ...rest,
     });
 }

package/dist/server/auth/providers/descope.js.map

@@ -1 +1 @@
-{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzE;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6D;IAE7D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC;QACpB,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAC9C,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/**\n * Derives the Descope Project ID from an MCP Server URL\n * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the\n * project id, so it doubles as the audience.\n */\nfunction projectIdFromUrl(url: string): string {\n  const projectId = url.match(/\\/agentic\\/([^/]+)\\/[^/]+/)?.[1];\n  if (!projectId) {\n    throw new Error(\n      `Could not derive the Descope project id from \"${url}\"; pass an explicit \\`audience\\`.`,\n    );\n  }\n  return projectId;\n}\n\n/**\n * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery\n * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.\n * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your\n * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR\n * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`\n * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to\n * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client\n * id, project id], not the server URL; pass `audience` to override.\n */\nexport function descopeProvider(\n  opts: { url: string } & Omit<CustomProviderOptions, \"issuer\">,\n): Promise<OAuthConfig> {\n  const { url, audience, ...rest } = opts;\n  const issuer = url.replace(/\\/\\.well-known\\/[^?#]*$/, \"\").replace(/\\/$/, \"\");\n  return customProvider({\n    issuer,\n    audience: audience ?? projectIdFromUrl(issuer),\n    ...rest,\n  });\n}\n"]}
+{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzE;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6D;IAE7D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IACxE,OAAO,cAAc,CAAC;QACpB,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,SAAS;QAC/B,mBAAmB,EAAE,GAAG;QACxB,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/**\n * Derives the Descope Project ID from an MCP Server URL\n * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the\n * project id, so it doubles as the audience.\n */\nfunction projectIdFromUrl(url: string): string {\n  const projectId = url.match(/\\/agentic\\/([^/]+)\\/[^/]+/)?.[1];\n  if (!projectId) {\n    throw new Error(\n      `Could not derive the Descope project id from \"${url}\"; pass an explicit \\`audience\\`.`,\n    );\n  }\n  return projectId;\n}\n\n/**\n * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery\n * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.\n * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your\n * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR\n * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`\n * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to\n * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client\n * id, project id], not the server URL; pass `audience` to override.\n */\nexport function descopeProvider(\n  opts: { url: string } & Omit<CustomProviderOptions, \"issuer\">,\n): Promise<OAuthConfig> {\n  const { url, audience, ...rest } = opts;\n  const projectId = projectIdFromUrl(url);\n  const issuer = `${url.slice(0, url.indexOf(\"/agentic/\"))}/${projectId}`;\n  return customProvider({\n    issuer,\n    audience: audience ?? projectId,\n    authorizationServer: url,\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/providers/descope.test.js

@@ -14,23 +14,25 @@ function discoveryDoc(issuer) {
     };
 }
 function mockDiscovery(issuer) {
-    return vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(discoveryDoc(issuer)), {
+    return vi.spyOn(globalThis, "fetch").mockImplementation(async () => new Response(JSON.stringify(discoveryDoc(issuer)), {
         headers: { "content-type": "application/json" },
     }));
 }
 describe("descopeProvider", () => {
-    it("derives issuer and audience (project id) from the MCP Server URL", async () => {
-        const issuer = "https://api.descope.com/v1/apps/agentic/P123/MS456";
-        const fetchSpy = mockDiscovery(issuer);
-        const config = await descopeProvider({ url: issuer });
-        expect(fetchSpy).toHaveBeenCalledWith(`${issuer}/.well-known/openid-configuration`, expect.anything());
-        expect(config.verify.issuer).toBe(issuer);
+    it("builds the base-project issuer and audience (project id) from the MCP Server URL", async () => {
+        const url = "https://api.descope.com/v1/apps/agentic/P123/MS456";
+        const base = "https://api.descope.com/v1/apps/P123";
+        const fetchSpy = mockDiscovery(base);
+        const config = await descopeProvider({ url });
+        expect(fetchSpy).toHaveBeenCalledWith(`${base}/.well-known/openid-configuration`, expect.anything());
+        expect(config.verify.issuer).toBe(base);
         expect(config.verify.audience).toBe("P123");
+        expect(config.oauthMetadata.issuer).toBe(url);
     });
     it("lets an explicit audience override the derived project id", async () => {
-        const issuer = "https://api.descope.com/v1/apps/agentic/P123/MS456";
-        mockDiscovery(issuer);
-        const config = await descopeProvider({ url: issuer, audience: "custom" });
+        const url = "https://api.descope.com/v1/apps/agentic/P123/MS456";
+        mockDiscovery("https://api.descope.com/v1/apps/P123");
+        const config = await descopeProvider({ url, audience: "custom" });
         expect(config.verify.audience).toBe("custom");
     });
 });

package/dist/server/auth/providers/descope.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"descope.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE;QACjD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,MAAM,GAAG,oDAAoD,CAAC;QACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,MAAM,mCAAmC,EAC5C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,oDAAoD,CAAC;QACpE,aAAa,CAAC,MAAM,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { descopeProvider } from \"./descope.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction discoveryDoc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nfunction mockDiscovery(issuer: string) {\n  return vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n    new Response(JSON.stringify(discoveryDoc(issuer)), {\n      headers: { \"content-type\": \"application/json\" },\n    }),\n  );\n}\n\ndescribe(\"descopeProvider\", () => {\n  it(\"derives issuer and audience (project id) from the MCP Server URL\", async () => {\n    const issuer = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    const fetchSpy = mockDiscovery(issuer);\n\n    const config = await descopeProvider({ url: issuer });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${issuer}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(config.verify.issuer).toBe(issuer);\n    expect(config.verify.audience).toBe(\"P123\");\n  });\n\n  it(\"lets an explicit audience override the derived project id\", async () => {\n    const issuer = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    mockDiscovery(issuer);\n\n    const config = await descopeProvider({ url: issuer, audience: \"custom\" });\n\n    expect(config.verify.audience).toBe(\"custom\");\n  });\n});\n"]}
+{"version":3,"file":"descope.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,kBAAkB,CACrD,KAAK,IAAI,EAAE,CACT,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE;QACjD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CACL,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,GAAG,GAAG,oDAAoD,CAAC;QACjE,MAAM,IAAI,GAAG,sCAAsC,CAAC;QACpD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAE9C,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,IAAI,mCAAmC,EAC1C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,GAAG,GAAG,oDAAoD,CAAC;QACjE,aAAa,CAAC,sCAAsC,CAAC,CAAC;QAEtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAElE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { descopeProvider } from \"./descope.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction discoveryDoc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nfunction mockDiscovery(issuer: string) {\n  return vi.spyOn(globalThis, \"fetch\").mockImplementation(\n    async () =>\n      new Response(JSON.stringify(discoveryDoc(issuer)), {\n        headers: { \"content-type\": \"application/json\" },\n      }),\n  );\n}\n\ndescribe(\"descopeProvider\", () => {\n  it(\"builds the base-project issuer and audience (project id) from the MCP Server URL\", async () => {\n    const url = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    const base = \"https://api.descope.com/v1/apps/P123\";\n    const fetchSpy = mockDiscovery(base);\n\n    const config = await descopeProvider({ url });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${base}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(config.verify.issuer).toBe(base);\n    expect(config.verify.audience).toBe(\"P123\");\n    expect(config.oauthMetadata.issuer).toBe(url);\n  });\n\n  it(\"lets an explicit audience override the derived project id\", async () => {\n    const url = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    mockDiscovery(\"https://api.descope.com/v1/apps/P123\");\n\n    const config = await descopeProvider({ url, audience: \"custom\" });\n\n    expect(config.verify.audience).toBe(\"custom\");\n  });\n});\n"]}

package/dist/server/auth/security-schemes.d.ts

@@ -11,3 +11,13 @@ export declare function evaluateSecuritySchemes(schemes: SecurityScheme[] | unde
 export declare function httpStatusForFailure(failure: SchemeFailure): 401 | 403;
 export declare function clientPrefersInBandChallenge(userAgent: string | undefined): boolean;
 export declare function wwwAuthenticateHeader(failure: SchemeFailure, resourceMetadataUrl?: string): string;
+export declare function inBandChallengeResult(failure: SchemeFailure, resourceMetadataUrl?: string): {
+    isError: boolean;
+    content: {
+        type: "text";
+        text: string;
+    }[];
+    _meta: {
+        "mcp/www_authenticate": string[];
+    };
+};